CVE-2011-4576
NoneCVSS
—
EPSS
15.6%
Published
Jan 6, 2012
CISA due date
—
The record
The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | openssl | 0 | 1.0.0f-1 |
| Debian:12 | openssl | 0 | 1.0.0f-1 |
| Debian:13 | openssl | 0 | 1.0.0f-1 |
| Debian:5.0 | openssl | 0 | 0.9.8g-15+lenny15 |
| Debian:6.0 | openssl | 0 | 0.9.8o-4squeeze5 |
| Red Hat:enterprise_linux:4::as | openssl | 0 | 0:0.9.7a-43.18.el4 |
| Red Hat:enterprise_linux:4::as | openssl-debuginfo | 0 | 0:0.9.7a-43.18.el4 |
| Red Hat:enterprise_linux:4::as | openssl-devel | 0 | 0:0.9.7a-43.18.el4 |
| Red Hat:enterprise_linux:4::as | openssl-perl | 0 | 0:0.9.7a-43.18.el4 |
| Red Hat:enterprise_linux:4::desktop | openssl | 0 | 0:0.9.7a-43.18.el4 |
| Red Hat:enterprise_linux:4::desktop | openssl-debuginfo | 0 | 0:0.9.7a-43.18.el4 |
| Red Hat:enterprise_linux:4::desktop | openssl-devel | 0 | 0:0.9.7a-43.18.el4 |
| Red Hat:enterprise_linux:4::desktop | openssl-perl | 0 | 0:0.9.7a-43.18.el4 |
| Red Hat:enterprise_linux:4::es | openssl | 0 | 0:0.9.7a-43.18.el4 |
| Red Hat:enterprise_linux:4::es | openssl-debuginfo | 0 | 0:0.9.7a-43.18.el4 |
| Red Hat:enterprise_linux:4::es | openssl-devel | 0 | 0:0.9.7a-43.18.el4 |
| Red Hat:enterprise_linux:4::es | openssl-perl | 0 | 0:0.9.7a-43.18.el4 |
| Red Hat:enterprise_linux:4::ws | openssl | 0 | 0:0.9.7a-43.18.el4 |
| Red Hat:enterprise_linux:4::ws | openssl-debuginfo | 0 | 0:0.9.7a-43.18.el4 |
| Red Hat:enterprise_linux:4::ws | openssl-devel | 0 | 0:0.9.7a-43.18.el4 |
| Red Hat:enterprise_linux:4::ws | openssl-perl | 0 | 0:0.9.7a-43.18.el4 |
| Red Hat:enterprise_linux:5::client | openssl | 0 | 0:0.9.8e-20.el5_7.1 |
| Red Hat:enterprise_linux:5::client | openssl-debuginfo | 0 | 0:0.9.8e-20.el5_7.1 |
| Red Hat:enterprise_linux:5::client | openssl-devel | 0 | 0:0.9.8e-20.el5_7.1 |
| Red Hat:enterprise_linux:5::client | openssl-perl | 0 | 0:0.9.8e-20.el5_7.1 |
| Red Hat:enterprise_linux:5::client_workstation | openssl | 0 | 0:0.9.8e-20.el5_7.1 |
| Red Hat:enterprise_linux:5::client_workstation | openssl-debuginfo | 0 | 0:0.9.8e-20.el5_7.1 |
| Red Hat:enterprise_linux:5::client_workstation | openssl-devel | 0 | 0:0.9.8e-20.el5_7.1 |
| Red Hat:enterprise_linux:5::client_workstation | openssl-perl | 0 | 0:0.9.8e-20.el5_7.1 |
| Red Hat:enterprise_linux:5::server | openssl | 0 | 0:0.9.8e-20.el5_7.1 |
| Red Hat:enterprise_linux:5::server | openssl-debuginfo | 0 | 0:0.9.8e-20.el5_7.1 |
| Red Hat:enterprise_linux:5::server | openssl-devel | 0 | 0:0.9.8e-20.el5_7.1 |
| Red Hat:enterprise_linux:5::server | openssl-perl | 0 | 0:0.9.8e-20.el5_7.1 |
| Red Hat:enterprise_linux:6::client | openssl | 0 | 0:1.0.0-20.el6_2.1 |
| Red Hat:enterprise_linux:6::client | openssl-debuginfo | 0 | 0:1.0.0-20.el6_2.1 |
| Red Hat:enterprise_linux:6::client | openssl-devel | 0 | 0:1.0.0-20.el6_2.1 |
| Red Hat:enterprise_linux:6::client | openssl-perl | 0 | 0:1.0.0-20.el6_2.1 |
| Red Hat:enterprise_linux:6::client | openssl-static | 0 | 0:1.0.0-20.el6_2.1 |
| Red Hat:enterprise_linux:6::computenode | openssl | 0 | 0:1.0.0-20.el6_2.1 |
| Red Hat:enterprise_linux:6::computenode | openssl-debuginfo | 0 | 0:1.0.0-20.el6_2.1 |
| Red Hat:enterprise_linux:6::computenode | openssl-devel | 0 | 0:1.0.0-20.el6_2.1 |
| Red Hat:enterprise_linux:6::computenode | openssl-perl | 0 | 0:1.0.0-20.el6_2.1 |
| Red Hat:enterprise_linux:6::computenode | openssl-static | 0 | 0:1.0.0-20.el6_2.1 |
| Red Hat:enterprise_linux:6::hypervisor | rhev-hypervisor6 | 0 | 0:6.2-20120209.0.el6_2 |
| Red Hat:enterprise_linux:6::hypervisor | rhev-hypervisor6-tools | 0 | 0:6.2-20120209.0.el6_2 |
| Red Hat:enterprise_linux:6::server | openssl | 0 | 0:1.0.0-20.el6_2.1 |
| Red Hat:enterprise_linux:6::server | openssl-debuginfo | 0 | 0:1.0.0-20.el6_2.1 |
| Red Hat:enterprise_linux:6::server | openssl-devel | 0 | 0:1.0.0-20.el6_2.1 |
| Red Hat:enterprise_linux:6::server | openssl-perl | 0 | 0:1.0.0-20.el6_2.1 |
| Red Hat:enterprise_linux:6::server | openssl-static | 0 | 0:1.0.0-20.el6_2.1 |
| Red Hat:enterprise_linux:6::workstation | openssl | 0 | 0:1.0.0-20.el6_2.1 |
| Red Hat:enterprise_linux:6::workstation | openssl-debuginfo | 0 | 0:1.0.0-20.el6_2.1 |
| Red Hat:enterprise_linux:6::workstation | openssl-devel | 0 | 0:1.0.0-20.el6_2.1 |
| Red Hat:enterprise_linux:6::workstation | openssl-perl | 0 | 0:1.0.0-20.el6_2.1 |
| Red Hat:enterprise_linux:6::workstation | openssl-static | 0 | 0:1.0.0-20.el6_2.1 |
| SUSE:Linux Enterprise Desktop 12 | libqt4 | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Desktop 12 | libqt4-sql-plugins | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Desktop 12 SP1 | libqt4 | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Desktop 12 SP1 | libqt4-sql-plugins | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Server 12 | libqt4 | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Server 12 | libqt4-devel-doc | 0 | 4.8.6-7.3 |
| SUSE:Linux Enterprise Server 12 | libqt4-sql-plugins | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Server 12 SP1 | libqt4 | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Server 12 SP1 | libqt4-devel-doc | 0 | 4.8.6-7.3 |
| SUSE:Linux Enterprise Server 12 SP1 | libqt4-sql-plugins | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 | libqt4 | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 | libqt4-devel-doc | 0 | 4.8.6-7.3 |
| SUSE:Linux Enterprise Server for SAP Applications 12 | libqt4-sql-plugins | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | libqt4 | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | libqt4-devel-doc | 0 | 4.8.6-7.3 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | libqt4-sql-plugins | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Software Development Kit 12 | libqt4 | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Software Development Kit 12 | libqt4-devel-doc | 0 | 4.8.6-7.3 |
| SUSE:Linux Enterprise Software Development Kit 12 | libqt4-sql-plugins | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP1 | libqt4 | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP1 | libqt4-devel-doc | 0 | 4.8.6-7.3 |
| SUSE:Linux Enterprise Software Development Kit 12 SP1 | libqt4-sql-plugins | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Workstation Extension 12 | libqt4 | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Workstation Extension 12 | libqt4-sql-plugins | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Workstation Extension 12 SP1 | libqt4 | 0 | 4.8.6-7.1 |
| SUSE:Linux Enterprise Workstation Extension 12 SP1 | libqt4-sql-plugins | 0 | 4.8.6-7.1 |
| openSUSE:Tumbleweed | openssl-1_1 | 0 | 1.1.1l-1.2 |
| openSUSE:Tumbleweed | tor | 0 | 0.2.8.11-1.1 |
Related vulnerabilities
- CVE-2024-13176 Issue summary: A timing side-channel which could potentially allow recovering the private… Also affects openssl
- CVE-2024-4741 Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be… Also affects openssl
- CVE-2024-9143 Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit… Also affects openssl
- CVE-2024-5535 Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty… Also affects openssl
- CVE-2024-2511 Issue summary: Some non-default TLS server configurations can cause unbounded memory… Also affects openssl
- CVE-2024-0727 Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash… Also affects openssl
- CVE-2023-5678 Issue summary: Generating excessively long X9.42 DH keys or checking excessively long… Also affects openssl
- CVE-2022-0778 The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can… Also affects openssl